Repository navigation
Google Play launch readiness: finish VPS deployment, signing, assetlinks, Play Console and device QA #340
Description
Objective
Move MenuMinute Restaurant Manager (com.bababuilds.menuminute) from the merged Android foundation PR #338 to a verified Google Play Internal Testing release, then closed testing/production when eligible. No production Play launch is authorized by this issue.
Confirmed baseline (2026-11-08)
- PR Android release foundation A–F: mobile CI, TWA, Play billing boundary and BLE receipts #338 merged:
ddc533d02f2cee66cd6e9e41452c2a5d329c3315. - Post-merge main CI passed: https://github.com/baba-dev/menuminute/actions/runs/42414592272 .
- ARM64 artifact published: https://github.com/baba-dev/menuminute/actions/runs/42415183590 .
- P0 deployment unblocked: operator cleared disk space; retry attempt 2 passed staging, activation and public verification: https://github.com/baba-dev/menuminute/actions/runs/42415227352 . The 4 GiB safety threshold was preserved.
- Live Android app entry deployed:
/appredirects to authentication,/api/app/launchis routed./.well-known/assetlinks.jsonnow returns 503, correctly blocking verification until the actual Play App Signing certificate fingerprint is configured.
Gate 0: Recover safe VPS staging
- Run read-only disk audit on VPS and retain output in private operator notes (no env contents/passwords):
df -h / /var/www/menuminute /var/lib/menuminute sudo du -xhd1 /var/www/menuminute /var/lib/menuminute /var/log /var/cache 2>/dev/null | sort -h | tail -45 readlink -f /var/www/menuminute/current readlink -f /var/www/menuminute/worker-current sudo find /var/www/menuminute/releases -mindepth 1 -maxdepth 1 -type d -printf '%TY-%Tm-%Td %p\n' | sort
- Safely free enough space to exceed 4 GiB before staging. Review old release dirs/incoming archives and preserve active web, worker, rollback targets, user media, DB, env and backups. Never run blanket Docker volume prune / restic deletion.
- Reran the same reviewed main release through existing gated deployment workflow. Verified MenuMinute web, worker, PostgreSQL, Redis queue/cache and ERP healthy at SHA
ddc533d02f2cee66cd6e9e41452c2a5d329c3315. - Verified public
/appis login-gated and/api/app/launchroute now exists (redirect observed). Cookie attributes still require direct response-header check before Play launch./.well-known/assetlinks.jsonreturns 503 until a verified SHA256 signing fingerprint is supplied.
Gate 1: Google Play app and identity
- Google Play developer account verification passed (owner confirmed 2026-11-10). App creation, first Play AAB upload, and closed-test/production-access requirements remain separate verification gates.
- Create app named MenuMinute Restaurant Manager, default language English, developer support contact
admin@bababuilds.com. - Confirm permanent Android application ID
com.bababuilds.menuminutebefore first AAB upload. - Confirm Android 16/API 36 target meets current requirement.
Gate 2: Sign release privately
- Generate upload-only JKS locally with JDK keytool; back it up off repository with password in a secure secret manager. Do not post/share keystore or key passwords in GitHub issues/chat.
- GitHub Actions environment
android-play-internalcreated by owner and used successfully by signed candidate run #42496478422. Verify environment branch restriction and reviewers separately. - Configure environment secrets (owner confirmed four names; signing run verified key availability without exposing values):
ANDROID_UPLOAD_KEYSTORE_BASE64,ANDROID_UPLOAD_STORE_PASSWORD,ANDROID_UPLOAD_KEY_ALIAS,ANDROID_UPLOAD_KEY_PASSWORD. - Manually ran workflow on reviewed
main(008c7aefa1c9434d0d2911168d1b9e862604b744). Run #42496478422 succeeded; Gradle built AAB,jar verified.passed, artifactmenuminute-android-signed-008c7aefa1c9434d0d2911168d1b9e862604b744uploaded (ID13624040761, 7-day retention). Owner still to download and preserve AAB + SHA-256. - Upload signed AAB to Play internal testing, enroll in Play App Signing. An APK is only for sideload/internal troubleshooting.
Gate 3: Digital Asset Links and trusted fullscreen
- From Play Console
App integrity / Play app signing, copy the App signing key certificate SHA-256 (NOT the upload key's certificate) after app enrollment. - Set valid
ANDROID_PLAY_APP_SIGNING_SHA256=XX:..(32 bytes)in/etc/menuminute/web.envprivately, restart/redeploy web process through controlled procedure. Never commit the fingerprint's private key; fingerprint itself is public. - Verify
https://food.bababuilds.com/.well-known/assetlinks.jsonreturns HTTP 200, JSON targetcom.bababuilds.menuminute, correct SHA-256, publicly reachable, no redirect. - Install from Play internal track, confirm TWA fullscreen with no fallback Chrome browser toolbar. Test Android Back, app restart, auth, Google sign-in and logout.
Gate 4: Play Console declarations / store listing
- Privacy URL:
https://food.bababuilds.com/privacy(already publicly accessible). - Account deletion URL:
https://food.bababuilds.com/delete-account(already publicly accessible; owner confirmed workflow). - Complete Data safety against actual live features: account/contact, guest CRM, order history, photos/uploads, analytics, logs, session/push endpoint, AI providers, processors. Never claim 'no collection' merely because Android shell has no SDK.
- App access: dedicated non-admin reviewer test merchant with stable reusable credentials, reachable internationally, without one-time MFA blocking Play reviewers. Do not put passwords in this issue.
- Set ad/age/content-rating/target-audience declarations accurately; free app with no digital checkout (consumption only).
- Complete store listing: 512x512 app icon, 1024x500 opaque feature graphic, 2+ real Android screenshots, short/full description, support details.
- Audit Play client all payment-entry and deep-link routes to ensure no Razorpay checkout for digital subscriptions inside TWA, while web Razorpay and existing paid entitlements remain supported.
Gate 5: Device tests / release
- Execute
docs/android-release/device-test-matrix.mdon physical Android phones/tablets including Chrome TWA, OAuth, MFA, POS orders, Kitchen background/reconnect, camera, 58/80 mm BLE printers, denied printer permissions and Print/PDF fallback. Bluetooth Classic/USB unsupported until separately built and verified. - Use Play internal testing first. Capture crash/ANR, TWA full-screen, order and printing evidence.
- If personal Play developer account created after 2023-11-13, meet 12 opted-in testers continuously for 14 days before applying for production access (verify account-specific requirements in Play Console).
- Review Play's latest policy warnings / rejection notices; move to staged production only after every gate has evidence and signoff.
Evidence and references
- Source release procedures:
android/README.md,docs/android-release/README.md,docs/android-release/device-test-matrix.md,.github/workflows/android-release.yml. - Play Console: https://play.google.com/console/
- Google target API: https://support.google.com/googleplay/android-developer/answer/11926878
- Play App Signing: https://support.google.com/googleplay/android-developer/answer/9842756
- Play testing: https://support.google.com/googleplay/android-developer/answer/14151465
- TWA association: https://developer.android.com/training/app-links/configure-assetlinks
Privacy/safety: Do not paste keys, tokens, env file contents, or unmasked customer data in this issue.
Activity
baba-dev commentedon Nov 8, 2026
Signing preparation now tracked independently in PR #343, based on current main and non-overlapping with Claude's draft PR #342. It supplies a portable-JDK17 local Windows generator and hardens the Android signed AAB GitHub Actions workflow (main-only; short-lived environment secrets; verify JKS alias; remove temporary key). Owner action remains mandatory: generate and privately back up the upload JKS, create restricted
android-play-internalGitHub environment, and enter four environment secrets. No credentials or keystore have been generated, retrieved or uploaded by ChatGPT. Sign the intended release only after #342 is reviewed, merged and exact-head Android CI passes.baba-dev commentedon Nov 8, 2026
Update: Play signing setup PR #343 merged into
mainat3a533780fc505c96c8318697e0132f67f667a68a, after exact-head green CI https://github.com/baba-dev/menuminute/actions/runs/42460674025. Includesscripts/android/prepare-play-signing.ps1,docs/android-release/signing-setup.md, and hardened Android manual signing workflow. Still not complete: owner must generate and encrypt offline backup ofmenuminute-upload.jkslocally, create restrictedandroid-play-internalenvironment and add four secrets, then (after PR #342 merge and CI) invoke manual signing workflow. No real key was created or uploaded through ChatGPT; no AAB has been signed in this operation.baba-dev commentedon Nov 8, 2026
2026-11-08 owner update: GitHub environment
android-play-internaland all four required signing secrets have been created (owner-reported; secret names/values cannot be read or verified by the GitHub app). PR #342 is merged inmain(ed134eb99c7ce6d1232a68529a5e68684909b4f4); main CI and production deploy both passed. Next action: manually dispatch Android signed internal-release candidate onmain, verify signing and AAB artifact, and retain a private offline keystore backup. GitHub connector lacks workflow_dispatch permission; no signed candidate has been launched in this chat.baba-dev commentedon Nov 8, 2026
Resolved the first signed AAB candidate failure: run 42490767388 successfully loaded the JKS and built signed AAB, but
jarsigner -verify -strictfailed with exit 4 because the Google Play upload certificate is intentionally self-signed (PKIX path failure). Regression-tested fix merged in PR #344 at008c7aefa1c9434d0d2911168d1b9e862604b744; all 19 PR CI jobs passed at run 42491513264. The workflow now validates strictly using only the configured JKS trust store, preserving signature integrity; local test confirmed modified signed contents still fail. No keystore or GitHub secret changes required. Owner must launch a newAndroid signed internal-release candidateworkflow manually on updatedmain—do not rerun the old failed job, which uses the previous workflow revision. A signed artifact is not yet confirmed.baba-dev commentedon Nov 8, 2026
Implemented the split Android versus SaaS web release workflow in merged PR #346, SHA
a4065c145a31810958da3fdc673b140903a531db. All 19 PR CI jobs passed (run 42514363796). Reviewed native files (android/,scripts/android/, signing workflow) now generate a versioned, strictly verified signed candidate automatically after green current-main push CI; web-only updates retain the original web/VPS pipeline and do not generate Play AABs. VersionCode uses per-workflow run_number+1 (initially signed code1). Signed candidate has 30-day checksum/provenance artifact.Google Play internal draft submissionis a separate manual-only, reviewer-gated, WIF-authenticated workflow that requiresandroid-play-publishenv withPLAY_PUBLISH_ENABLED=trueand can only submit an internal draft, with distribution requiring another owner Play Console action. Not configured or tested on live Google Play yet; developer identity/Play app/first manual upload/assetlinks/device QA remain outstanding. Current merged-main CI run 42514821347 is pending verification.baba-dev commentedon Nov 8, 2026
First end-to-end automatic Android signed release verified after PR #346 merge. Exact reviewed main SHA
a4065c145a31810958da3fdc673b140903a531db; main CI #42514821347 passed 19/19 jobs. This automatically triggered Android signed candidate #42515347084 viaworkflow_run; preflight passed, Gradle BUILD SUCCESSFUL, trusted upload cert jar verified., and artifactmenuminute-android-signed-a4065c145a31810958da3fdc673b140903a531db-3(ID 13631087826) was uploaded containing the signed AAB, checksum and provenance JSON. Managed release version:1.0.3/ versionCode4(workflow run_number=3). All GitHub signing jobs succeeded, reusing existing JKS without credential changes. Independent ARM64 publish #42515347093 and VPS deploy #42515410342 also passed. Google Play API uploader remains intentionally disabled, pending the separately protectedandroid-play-publishenvironment and Play Console developer/app/API setup; no store upload/distribution has occurred. This validates the independent web and native release tracks.baba-dev commentedon Nov 9, 2026
Google Play reviewer fixture prepared in merged PR #347, SHA
c7b12c771aafb78a1242af691b1cb4790bb2f259; 19/19 exact-head PR CI jobs passed in run #42696967343. Adds isolated normal Better Auth "Reviewer Account" tenant "The Droid Pie" with 55 dishes across 6 categories, 10 tables, sample orders, three KDS stations/routes, two non-billable reviewer entitlements (Ordering/Kitchen; normal POS enabled), synthetic reservations and CRM guests. Includes one-time owner-only runtime provisioner and runbook, no hardcoded secrets or auto-provision in deploy. Owner's provided password was never checked in; use an owner-controlled reviewer email and a newly rotated private 16+ character password. Not live/provisioned yet; user must execute the one-time operator command against production migration owner credentials once the post-merge VPS release succeeds and then verify clean Android login/functional review. Main CI: run #42697755381 ongoing.baba-dev commentedon Nov 9, 2026
Owner confirmed 2026-11-10: the one-time production VPS Play reviewer provisioner ran successfully with an owner-controlled reviewer email and reported The Droid Pie; 55 dishes; 119 synthetic orders; 10 tables. Credentials were not included in logs or this issue. The dedicated real-login reviewer tenant was created in the production database (owner-reported), and the exact merged commit
c7b12c771aafb78a1242af691b1cb4790bb2f259passed CI, signed Android candidate and production VPS deploy #42698954093. Remaining verification: test login in a clean Android/browser session; test feature access, menu and kitchen; rotate any password previously shared in conversation and provision withPLAY_REVIEWER_ROTATE_PASSWORD=trueif needed; delete the temporary root-only reviewer env file afterward; add verified credentials privately to Google Play Console App access. No claim yet that manual end-to-end login or Google review succeeded.baba-dev commentedon Nov 10, 2026
2026-11-10: Owner configured
ANDROID_PLAY_APP_SIGNING_SHA256. Live public/.well-known/assetlinks.jsonindependently retrieved and showscom.bababuilds.menuminute,delegate_permission/common.handle_all_urls, and SHA-25674:12:F2:A3:3C:E5:AC:2A:84:53:91:E7:2B:F3:74:13:F7:BE:2F:44:F1:9D:19:75:BE:FB:66:C6:6D:B8:15:2B. Source routesrc/app/.well-known/assetlinks.json/route.tsvalidated to emit configured fingerprint. Website association configured; physical Play-installed Android TWA fullscreen verification remains pending, as does confirming this value is the Play app signing certificate and not the upload key. For device QA: install from Internal Testing opt-in link, open app, confirm Chrome address bar absent, test login (Play reviewer sample tenant), Dashboard/POS/Orders/Kitchen/QR, reload/logout, and assess billing/printer integration separately.baba-dev commentedon Nov 10, 2026
P0 Android Play internal launch crash reproduced and diagnosed (2026-11-10). After owner reported the Play-installed app immediately closes, a new API 35 Google Play emulator launch smoke workflow reproduced a Java fatal exception in run #42804640519:
IllegalArgumentException: Component class com.google.androidbrowserhelper.trusted.ManageDataLauncherActivity does not exist in com.bababuilds.menuminute, raised byLauncherActivityon startup. The missing component was added toandroid/app/src/main/AndroidManifest.xml, with its site-settings metadata and regression test, in PR #349. Before/after emulator test passed on fixed manifest in run #42805335697:Status: ok, no Java fatal exception. Final current-head CI and emulator checks are still running. Next release gate: merge only after CI passes, obtain higher-version signed AAB, upload new internal testing release, test on same physical device. The temporary Play listing name/icon are normal before app review and unrelated to this native crash. No credentials or keys changed.baba-dev commentedon Nov 10, 2026
Startup crash remediation merged via PR #349, main commit
3c6f95c59bd1b11ab29cef4a9c0060accbd16b5b. Root cause verified by real emulator crash stack: missingcom.google.androidbrowserhelper.trusted.ManageDataLauncherActivitydeclaration. Fixed manifest, added version-controlled regression test and Android emulator startup smoke workflow. Corrected startup passed on clean Google Play API 35 emulator at run #42805745875, and all 19 PR CI jobs passed at run #42805745914. Native code and package ID unchanged except companion activity/management metadata; keys & DAL unaffected. Existing Play internal app remains broken until updated via a new signed AAB. Post-merge main CI run #42806438654 is in progress, after which automatic signing should produce a higher-version AAB. Next action: owner uploads updated AAB to Play internal track, waits for availability and verifies on same Android phone; do not promote broken code4 package.baba-dev commentedon Nov 10, 2026
P0 fixed and signed replacement ready. Merged PR #349 at
3c6f95c59bd1b11ab29cef4a9c0060accbd16b5b; exact-main CI #42806438654 passed 19/19. The original emulator captured aFATAL EXCEPTIONbecauseManageDataLauncherActivitywas absent from the manifest; fixed emulator passed with no Java fatal at #42805745875. Automatic signed release #42807375988 passedBUILD SUCCESSFULandjar verified., producedcom.bababuilds.menuminute, version 1.0.6, versionCode 7, artifactmenuminute-android-signed-3c6f95c59bd1b11ab29cef4a9c0060accbd16b5b-6(artifact ID 13760575549, signed AAB SHA2568437ac6f4a2f0b014351575281c07ddc3f7ea7134e2c5eecff11370fd88a9aae). This is a signed candidate only, NOT uploaded to Play. Owner to create a NEW Internal Testing release using this AAB and verify Play-delivered update on same phone. Do not promote original versionCode 4.